feat(evidence): require verified post-condition for action success

[seonghobae]

Partial implementation of #28.

Buyer-visible correctness gap

OriginWeave's protected-main API contract explicitly says command return is not action success: success waits for an observed post-condition. The first version of this branch made verified provenance mandatory, but it still allowed provenance observed before dispatch to be packaged as successful action evidence. That temporal gap could turn a pre-existing page state into false success evidence for a later command.

TDD / RCA sequence

This lane is based directly on protected main 67af7c87589edc2039545af335c95064d9b8391c.

The original test-first cycle introduced VerifiedActionOutcomeEvidence and established that unverified/rejected provenance cannot represent successful action completion. The current temporal-ordering cycle then tightened that boundary:

1. test-only head a69874a5dd85e884bcc239241245e1c79997256a changed the public test contract to require dispatch and observation timestamps, a stable PostConditionPredatesDispatch error, read-only timestamp accessors, and allowance for equal ticks from a coarse monotonic clock;
2. CI run 31441186652 passed repository contracts and formatting, then failed at cargo check --locked --workspace --all-targets exactly because production still exposed the old five-argument constructor, lacked the timestamp getters, and lacked the new error variant, establishing the intended compile RED;
3. production head f4884b906597a4a1b3552031b6f07c2673a069f9 added the smallest fail-closed timestamp binding and documents the requirement that both values come from one monotonic clock domain; and
4. exact head 2c45411ed9aa0eecca2d06c85659db9f4bb85e4d updates the Unreleased changelog to record the temporal success-evidence contract precisely.

Current implemented boundary

Current exact head is 2c45411ed9aa0eecca2d06c85659db9f4bb85e4d against unchanged protected main 67af7c87589edc2039545af335c95064d9b8391c.

VerifiedActionOutcomeEvidence now binds:

• exact typed ActionKind;
• canonical target Origin;
• immutable complete ActionIntentDigest;
• one bounded first-slice PostConditionKind (UrlChanged, NodeStateChanged, DialogStateChanged, or NetworkMutationObserved);
• monotonic action-dispatch and post-condition-observation timestamps from the caller's single trusted clock domain; and
• the exact existing credential-safe ProvenanceRecord used as post-condition proof.

Construction fails closed unless provenance is VerificationResult::Verified and the observation timestamp is greater than or equal to dispatch. An observation that predates dispatch returns the stable typed PostConditionPredatesDispatch error. Equality is allowed because a bounded runtime may observe a post-condition within the same tick of a coarse monotonic clock.

Exact-head evidence

On unchanged exact head 2c45411ed9aa0eecca2d06c85659db9f4bb85e4d:

• CI run 31441848670: success;
• repository Python contracts: success;
• canonical Rust formatting: success;
• locked workspace/all-target check: success;
• full workspace tests: success;
• strict Clippy: success;
• rustdoc/API documentation: success;
• Production coverage job 93628017556: success, including exact owned production function/line/region/branch enforcement;
• Security Scan run 31441848649: success;
• SAST Semgrep run 31441848615: success;
• CodeRabbit exact-head commit status: success;
• no formal reviews or inline review threads are currently returned; and
• GitHub reports the PR mergeable.

No predecessor-head check, review, or mergeability result is transferred to this exact head.

Truth boundary

This PR is not a browser dispatcher, BiDi/CDP adapter, post-condition observer, policy/approval record, browser authority registry, durable evidence store, action-event persistence layer, or completed Chromium vertical slice. It now proves caller-supplied monotonic ordering relative to dispatch, but does not independently prove clock provenance, that the browser actually dispatched the action, that the observed provenance belongs to the target origin/node, or that a real browser reached the declared condition. Those responsibilities remain with the real adapter/runtime chain under #28.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 49 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: de64812a-aabf-405c-9000-aa5682fb5fb4

📥 Commits

Reviewing files that changed from the base of the PR and between 67af7c8 and 2c45411.

📒 Files selected for processing (4)

• CHANGELOG.md
• crates/originweave-evidence/src/action_outcome.rs
• crates/originweave-evidence/src/lib.rs
• crates/originweave-evidence/tests/verified_action_outcome.rs

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}